Abandoned Time4Popcorn updater still runs on millions of machines
Original title: Undead Software Projects Continue to Raise Security Risks
Eye Security says it still checks abandoned domains on more than 2.5 million Windows PCs and about 300,000 Macs.
Eye Security found a modified Time4Popcorn updater, from a 2014-era BitTorrent client, still checking outdated domains from client telemetry. The MSSP says the updater runs on more than 2.5 million Windows machines and an estimated 300,000 Macs and can execute code with full privileges for whoever controls a domain. Many of those domains were open to registration. With the project abandoned, Eye Security says it registered the domains because no vendor patch was coming.
Unconfirmed: The Mac count is an estimate, and the article does not say attackers already registered the domains.
- Users installed Popcorn Time but did not choose a long-running privileged updater.
- Eye Security calls the exposed names dropcatch domains.
- The article also cites watchTowr finding 150 abandoned Amazon S3 buckets in February 2025.
- Those buckets drew more than 8 million HTTP requests from governments and companies.
Impact: Full-privilege code execution if an updater domain is taken over
| Product | Affected |
|---|---|
| Time4Popcorn | 2014-era client still phoning home |
- 1.Identify and remove lingering Time4Popcorn or Popcorn Time updaters.
- Products
- Time4Popcorn
- Organizations
- Eye Security
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gmai.com | te cousins and include both typosquatting domains, such as "gmai[.]com," that try to catch browsers whose users mistyped a URL, |
| domain | polyfill.io | t in Markdown In 2024, Chinese company Funnull [bought the polyfill[.]io domain](https://www.darkreading.com/remote-workforce/poly |
| md5 | 1d1c29eff49426577dcf3e84cf3b98ff | k-openclaw-cline-users#recipe=similar-items&sourcecontentid=1d1c29eff49426577dcf3e84cf3b98ff) Supply Chain Attack Secretly Installs OpenClaw for Cline |
| md5 | 1e51d280261e34e0cc1db58fc4422dce | tepad-updates-6-months#recipe=similar-items&sourcecontentid=1e51d280261e34e0cc1db58fc4422dce) Chinese Hackers Hijack Notepad++ Updates for 6 Months by |
| md5 | 208b9846191967c692e5c2bf1e972959 | ay-light-patch-tuesday#recipe=similar-items&sourcecontentid=208b9846191967c692e5c2bf1e972959) Microsoft Fixes Exploited Zero Day in Light Patch Tuesday |
| md5 | 5f19c8eeeb93473c11fd921316903dea | iden-era-sbom-guidance#recipe=similar-items&sourcecontentid=5f19c8eeeb93473c11fd921316903dea) Trump Administration Rescinds Biden-Era Software Guidance |
From the original article
8 min read at darkreading.com
A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.
By Robert Lemos · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.